Esc
Junk Data - T1001.001
(ATT&CK® Technique)
Definition
Adversaries may add junk data to protocols used for command and control to make detection more difficult. By adding random or meaningless data to the protocols used for command and control, adversaries can prevent trivial methods for decoding, deciphering, or otherwise analyzing the traffic. Examples may include appending/prepending data with junk characters or writing junk characters between significant characters.
D3FEND Inferred Relationships
Browse the D3FEND knowledge graph by clicking on the nodes below.
graph LR; T1001001["Junk Data"] --> |produces| OutboundInternetNetworkTraffic["Outbound Internet Network Traffic"]; class T1001001 OffensiveTechniqueNode; class OutboundInternetNetworkTraffic ArtifactNode; click OutboundInternetNetworkTraffic href "/dao/artifact/d3f:OutboundInternetNetworkTraffic"; click T1001001 href "/offensive-technique/attack/T1001.001/"; click OutboundInternetNetworkTraffic href "/dao/artifact/d3f:OutboundInternetNetworkTraffic";Client-serverPayloadProfiling["Client-server Payload Profiling"] --> | analyzes | OutboundInternetNetworkTraffic["Outbound Internet Network Traffic"]; Client-serverPayloadProfiling["Client-server Payload Profiling"] -.-> | May Detect | T1001001["Junk Data"] ; class Client-serverPayloadProfiling DefensiveTechniqueNode; class OutboundInternetNetworkTraffic ArtifactNode; click Client-serverPayloadProfiling href "/technique/d3f:Client-serverPayloadProfiling"; NetworkTrafficCommunityDeviation["Network Traffic Community Deviation"] --> | analyzes | OutboundInternetNetworkTraffic["Outbound Internet Network Traffic"]; NetworkTrafficCommunityDeviation["Network Traffic Community Deviation"] -.-> | May Detect | T1001001["Junk Data"] ; class NetworkTrafficCommunityDeviation DefensiveTechniqueNode; class OutboundInternetNetworkTraffic ArtifactNode; click NetworkTrafficCommunityDeviation href "/technique/d3f:NetworkTrafficCommunityDeviation"; PerHostDownload-UploadRatioAnalysis["Per Host Download-Upload Ratio Analysis"] --> | analyzes | OutboundInternetNetworkTraffic["Outbound Internet Network Traffic"]; PerHostDownload-UploadRatioAnalysis["Per Host Download-Upload Ratio Analysis"] -.-> | May Detect | T1001001["Junk Data"] ; class PerHostDownload-UploadRatioAnalysis DefensiveTechniqueNode; class OutboundInternetNetworkTraffic ArtifactNode; click PerHostDownload-UploadRatioAnalysis href "/technique/d3f:PerHostDownload-UploadRatioAnalysis"; ProtocolMetadataAnomalyDetection["Protocol Metadata Anomaly Detection"] --> | analyzes | OutboundInternetNetworkTraffic["Outbound Internet Network Traffic"]; ProtocolMetadataAnomalyDetection["Protocol Metadata Anomaly Detection"] -.-> | May Detect | T1001001["Junk Data"] ; class ProtocolMetadataAnomalyDetection DefensiveTechniqueNode; class OutboundInternetNetworkTraffic ArtifactNode; click ProtocolMetadataAnomalyDetection href "/technique/d3f:ProtocolMetadataAnomalyDetection"; RelayPatternAnalysis["Relay Pattern Analysis"] --> | analyzes | OutboundInternetNetworkTraffic["Outbound Internet Network Traffic"]; RelayPatternAnalysis["Relay Pattern Analysis"] -.-> | May Detect | T1001001["Junk Data"] ; class RelayPatternAnalysis DefensiveTechniqueNode; class OutboundInternetNetworkTraffic ArtifactNode; click RelayPatternAnalysis href "/technique/d3f:RelayPatternAnalysis"; RemoteTerminalSessionDetection["Remote Terminal Session Detection"] --> | analyzes | OutboundInternetNetworkTraffic["Outbound Internet Network Traffic"]; RemoteTerminalSessionDetection["Remote Terminal Session Detection"] -.-> | May Detect | T1001001["Junk Data"] ; class RemoteTerminalSessionDetection DefensiveTechniqueNode; class OutboundInternetNetworkTraffic ArtifactNode; click RemoteTerminalSessionDetection href "/technique/d3f:RemoteTerminalSessionDetection"; NetworkTrafficSignatureAnalysis["Network Traffic Signature Analysis"] --> | analyzes | OutboundInternetNetworkTraffic["Outbound Internet Network Traffic"]; NetworkTrafficSignatureAnalysis["Network Traffic Signature Analysis"] -.-> | May Detect | T1001001["Junk Data"] ; class NetworkTrafficSignatureAnalysis DefensiveTechniqueNode; class OutboundInternetNetworkTraffic ArtifactNode; click NetworkTrafficSignatureAnalysis href "/technique/d3f:NetworkTrafficSignatureAnalysis"; UserGeolocationLogonPatternAnalysis["User Geolocation Logon Pattern Analysis"] --> | analyzes | OutboundInternetNetworkTraffic["Outbound Internet Network Traffic"]; UserGeolocationLogonPatternAnalysis["User Geolocation Logon Pattern Analysis"] -.-> | May Detect | T1001001["Junk Data"] ; class UserGeolocationLogonPatternAnalysis DefensiveTechniqueNode; class OutboundInternetNetworkTraffic ArtifactNode; click UserGeolocationLogonPatternAnalysis href "/technique/d3f:UserGeolocationLogonPatternAnalysis"; NetworkTrafficFiltering["Network Traffic Filtering"] --> | filters | OutboundInternetNetworkTraffic["Outbound Internet Network Traffic"]; NetworkTrafficFiltering["Network Traffic Filtering"] -.-> | May Isolate | T1001001["Junk Data"] ; class NetworkTrafficFiltering DefensiveTechniqueNode; class OutboundInternetNetworkTraffic ArtifactNode; click NetworkTrafficFiltering href "/technique/d3f:NetworkTrafficFiltering"; OutboundTrafficFiltering["Outbound Traffic Filtering"] --> | filters | OutboundInternetNetworkTraffic["Outbound Internet Network Traffic"]; OutboundTrafficFiltering["Outbound Traffic Filtering"] -.-> | May Isolate | T1001001["Junk Data"] ; class OutboundTrafficFiltering DefensiveTechniqueNode; class OutboundInternetNetworkTraffic ArtifactNode; click OutboundTrafficFiltering href "/technique/d3f:OutboundTrafficFiltering";